[Skiboot] [PATCH 1/2] tpm_extendl: report number of tpms that failed and properly measured

Claudio Carvalho cclaudio at linux.vnet.ibm.com
Wed Nov 2 09:43:37 AEDT 2016


Please, disregard this patch. V2 just posted:
[Skiboot][PATCH v2 0/3] Fix tpm_extendl() for multiple/no TPM scenarios

Thanks,
Claudio Carvalho

On 10/31/2016 01:12 AM, Claudio Carvalho wrote:
> This changes tpm_extendl() to report to the caller the number of tpms
> that successfully measured and failed to measure a given PCR. Thus, the
> caller can properly print messages and whenever it is necessary.
> 
> Signed-off-by: Claudio Carvalho <cclaudio at linux.vnet.ibm.com>
> ---
>  libstb/status_codes.h |  3 +--
>  libstb/stb.c          | 37 ++++++++++++++++++++++---------------
>  libstb/tpm_chip.c     | 42 +++++++++++++++++++++++++++++++-----------
>  libstb/tpm_chip.h     |  9 +++++++--
>  4 files changed, 61 insertions(+), 30 deletions(-)
> 
> diff --git a/libstb/status_codes.h b/libstb/status_codes.h
> index 64f9325..e67c17b 100644
> --- a/libstb/status_codes.h
> +++ b/libstb/status_codes.h
> @@ -28,8 +28,7 @@
> 
>  /* trusted boot */
>  #define STB_TRUSTED_MODE_DISABLED	 200
> -#define STB_EVENTLOG_FAILED	-200
> -#define STB_PCR_EXTEND_FAILED	-201
> +#define STB_MEASURE_FAILED		-200
> 
>  /* TPM */
>  #define STB_TPM_OVERFLOW	-300
> diff --git a/libstb/stb.c b/libstb/stb.c
> index be68a50..4991d93 100644
> --- a/libstb/stb.c
> +++ b/libstb/stb.c
> @@ -163,7 +163,9 @@ void stb_init(void)
>  int stb_final(void)
>  {
>  	uint32_t pcr;
> -	int rc = 0;
> +	int rc, measured, failed;
> +
> +	rc = 0;
> 
>  	if (trusted_mode) {
>  #ifdef STB_DEBUG
> @@ -184,11 +186,14 @@ int stb_final(void)
>  					TPM_ALG_SHA256_SIZE, TPM_ALG_SHA1,
>  					(uint8_t*) evFF.sha1,
>  					TPM_ALG_SHA1_SIZE, EV_SEPARATOR,
> -					"Skiboot Boot");
> -			if (rc)
> -				return rc;
> -			prlog(PR_NOTICE, "STB: 0xFFFFFFFF measured "
> -			      "to pcr%d\n", pcr);
> +					"Skiboot Boot", &measured, &failed);
> +			if (rc > 0)
> +				prlog(PR_NOTICE, "STB: 0xFFFFFFFF (pcr%d) not "
> +				      "measured. No tpm registered\n", pcr);
> +			else
> +				prlog(PR_NOTICE, "STB: 0xFFFFFFFF (pcr%d) "
> +				      "measured on %d tpms and failed on "
> +				      "%d tpms\n", pcr, measured, failed);
>  		}
>  		tpm_add_status_property();
>  	}
> @@ -204,11 +209,10 @@ int stb_final(void)
> 
>  int tb_measure(enum resource_id id, void *buf, size_t len)
>  {
> -	int rc, r;
> +	int r, rc, measured, failed;
>  	uint8_t digest[SHA512_DIGEST_LENGTH];
>  	const uint8_t *digestp;
> 
> -	rc = 0;
>  	digestp = NULL;
>  	if (!trusted_mode) {
>  		prlog(PR_NOTICE, "STB: %s skipped resource %d, "
> @@ -275,7 +279,6 @@ int tb_measure(enum resource_id id, void *buf, size_t len)
>  	}
> 
>  #ifdef STB_DEBUG
> -	/* print the payload/image hash */
>  	prlog(PR_NOTICE, "STB: %s hash:\n", resource_map[r].name);
>  	stb_print_data(digest, TPM_ALG_SHA256_SIZE);
>  #endif
> @@ -287,12 +290,16 @@ int tb_measure(enum resource_id id, void *buf, size_t len)
>  	rc = tpm_extendl(resource_map[r].pcr,
>  			 TPM_ALG_SHA256, digest, TPM_ALG_SHA256_SIZE,
>  			 TPM_ALG_SHA1,   digest, TPM_ALG_SHA1_SIZE,
> -			 EV_ACTION, resource_map[r].name);
> -	if (rc)
> -		return rc;
> -	prlog(PR_NOTICE, "STB: %s measured to pcr%d\n", resource_map[r].name,
> -	      resource_map[r].pcr);
> -	return 0;
> +			 EV_ACTION, resource_map[r].name, &measured, &failed);
> +
> +	if (rc > 0)
> +		prlog(PR_NOTICE, "STB: %s not measured. No tpm registered\n",
> +		      resource_map[r].name);
> +	else
> +		prlog(PR_NOTICE, "STB: %s (pcr%d) measured on %d tpms and "
> +		      "failed on %d tpms\n", resource_map[r].name,
> +		      resource_map[r].pcr, measured, failed);
> +	return rc;
>  }
> 
>  int sb_verify(enum resource_id id, void *buf, size_t len)
> diff --git a/libstb/tpm_chip.c b/libstb/tpm_chip.c
> index 1bfeb9a..0c81548 100644
> --- a/libstb/tpm_chip.c
> +++ b/libstb/tpm_chip.c
> @@ -187,12 +187,12 @@ void tpm_init(void)
> 
>  	if (list_empty(&tpm_list))
>  		/**
> -		 * @fwts-label TPMNotInitialized
> +		 * @fwts-label NoTPMRegistered
>  		 * @fwts-advice No TPM chip has been initialized. We may not
>  		 * have a compatible tpm driver or there is no tpm node in the
>  		 * device tree with the expected bindings.
>  		 */
> -		prlog(PR_ERR, "TPM: no tpm chip has been initialized\n");
> +		prlog(PR_ERR, "TPM: no tpm chip registered\n");
> 
>  }
> 
> @@ -214,15 +214,26 @@ void tpm_cleanup(void)
>  	list_head_init(&tpm_list);
>  }
> 
> +static void tpm_disable(struct tpm_chip *tpm)
> +{
> +	if (tpm) {
> +		tpm->enabled = false;
> +		prlog(PR_NOTICE, "STB: tpm%d disabled\n", tpm->id);
> +	}
> +}
> +
>  int tpm_extendl(TPM_Pcr pcr,
>  		TPM_Alg_Id alg1, uint8_t* digest1, size_t size1,
>  		TPM_Alg_Id alg2, uint8_t* digest2, size_t size2,
> -		uint32_t event_type, const char* event_msg)
> +		uint32_t event_type, const char* event_msg,
> +		int *tpm_measured, int *tpm_failed)
>  {
> -	int rc;
> +	int rc, measured, failed;
>  	TCG_PCR_EVENT2 event;
>  	struct tpm_chip *tpm = NULL;
> 
> +	measured = 0;
> +	failed = 0;
>  	rc = 0;
> 
>  	list_for_each(&tpm_list, tpm, link) {
> @@ -247,8 +258,9 @@ int tpm_extendl(TPM_Pcr pcr,
>  			 */
>  			prlog(PR_ERR, "TPM: %s -> elog%d FAILED: pcr%d et=%x rc=%d\n",
>  			      event_msg, tpm->id, pcr, event_type, rc);
> -			rc = STB_EVENTLOG_FAILED;
> -			goto error;
> +			tpm_disable(tpm);
> +			failed++;
> +			continue;
>  		}
>  #ifdef STB_DEBUG
>  		prlog(PR_NOTICE, "TPM: %s -> elog%d: pcr%d et=%x ls=%d\n",
> @@ -275,9 +287,12 @@ int tpm_extendl(TPM_Pcr pcr,
>  			 */
>  			prlog(PR_ERR, "TPM: %s -> tpm%d FAILED: pcr%d rc=%d\n",
>  			      event_msg, tpm->id, pcr, rc);
> -			rc = STB_PCR_EXTEND_FAILED;
> -			goto error;
> +			tpm_disable(tpm);
> +			failed++;
> +			continue;
>  		}
> +		measured++;
> +
>  #ifdef STB_DEBUG
>  		prlog(PR_NOTICE, "TPM: %s -> tpm%d: pcr%d\n", event_msg,
>  		      tpm->id, pcr);
> @@ -285,9 +300,14 @@ int tpm_extendl(TPM_Pcr pcr,
>  		tpm_print_pcr(tpm, pcr, alg2, size2);
>  #endif
>  	}
> -	return rc;
> -error:
> -	tpm->enabled = false;
> +
> +	if (failed > 0)
> +		rc = STB_MEASURE_FAILED;
> +
> +	if (tpm_measured)
> +		*tpm_measured = measured;
> +	if (tpm_failed)
> +		*tpm_failed = failed;
>  	return rc;
>  }
> 
> diff --git a/libstb/tpm_chip.h b/libstb/tpm_chip.h
> index d7363e7..bca8409 100644
> --- a/libstb/tpm_chip.h
> +++ b/libstb/tpm_chip.h
> @@ -91,13 +91,18 @@ extern int tpm_register_chip(struct dt_node *node, struct tpm_dev *dev,
>   * @size2: size of digest2. Either TPM_ALG_SHA1_SIZE or TPM_ALG_SHA256_SIZE
>   * @event_type: event type log. In skiboot, either EV_ACTION or EV_SEPARATOR.
>   * @event_msg: event log message that describes the event
> + * @measured: [optional] will have the number of tpms successfully measured
> + * @failed: [optional] will have the number of tpms failed to measure
>   *
> - * Returns O for success or a negative number if it fails.
> + * Returns: O for success,
> + *          STB_MEASURE_FAILED if no tpm initialized,
> + *          or a negative number if it fails.
>   */
>  extern int tpm_extendl(TPM_Pcr pcr,
>  		       TPM_Alg_Id alg1, uint8_t* digest1, size_t size1,
>  		       TPM_Alg_Id alg2, uint8_t* digest2, size_t size2,
> -		       uint32_t event_type, const char* event_msg);
> +		       uint32_t event_type, const char* event_msg,
> +		       int *measured, int *failed);
> 
>  /* Add status property to the TPM devices */
>  extern void tpm_add_status_property(void);
> 



More information about the Skiboot mailing list